Critical Symlink Traversal Vulnerability in Bubblewrap Package
Summary
RLSA-2026:85306: Important: bubblewrap security update. Affects bubblewrap versions < 0:0.4.0-3.el8_10. Fixed in 0:0.4.0-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bubblewrap is a core execution engine designed for unprivileged containers, functioning as a setuid binary on kernels that do not support user namespaces. It allows users to create isolated environments for running applications securely. However, its design can lead to vulnerabilities if not properly managed, particularly in scenarios involving symlink traversal.
Vulnerability Detail
The vulnerability identified as CVE-2026-87766 in Bubblewrap allows for symlink traversal via the /oldroot directory. This flaw can enable an attacker to write files outside of the intended sandbox during the setup phase, potentially compromising the security of the container and the host system. The ramifications of this vulnerability are significant, as it could lead to unauthorized access to sensitive files and data leakage.
How To Fix
Minimum fixed version
0:0.4.0-3.el8_10
This is the first release that contains the fix.
sudo dnf update bubblewrapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the /oldroot directory or implement additional file system permissions to mitigate the risk of symlink traversal until the package is updated.
Conclusion
The Bubblewrap package has a critical vulnerability that allows symlink traversal, posing significant security risks. It is crucial to update to the patched version to mitigate these risks. Users should also consider temporary workarounds until they can apply the update.
See every vulnerability recorded for bubblewrap →
FAQ
The CVSS score for this vulnerability is 8.8, indicating a high level of severity.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
The potential impacts include unauthorized file access, data leakage, and compromise of the host system's security.
Yes, the vulnerability is fixed in Bubblewrap version 0:0.4.0-3.el8_10 and later.
If an immediate update is not possible, consider implementing file system permissions to restrict access to vulnerable directories as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for bubblewrap.
